add support for CORS headers

[maks]

I'm working on a npm client to use in-browser and would like to be able to access registry.npmjs.org from a browser webpage without using a proxy.

[isaacs]

@iriscouch @jhs Is it possible to enable cors headers on couchdb? Config somewhere?

[isaacs]

I think I might have just enabled them. That was super easy. Can you test and see if it works?

[maks]

Wow thanks so much for such a quick response!!
A quick google found this: http://wiki.apache.org/couchdb/CORS#Enabling_CORS
but I've never used couch before and couldn't see where that config file is in npm src here

[maks]

I just tried http://registry.npmjs.org/bops/latest but can't see the cors headers?

[maks]

I should also mention I am testing using curl -Ii and with http://client.cors-api.appspot.com/client#?client_method=GET&client_credentials=false&server_url=http%3A%2F%2Fregistry.npmjs.org%2Fbops%2Flatest&server_enable=true&server_status=200&server_credentials=false&server_tabs=remote

[isaacs]

Yeah, I think I didn't do something. I'll dig into it later. People have
asked for this a few times, so it'd be good to just do it.

On Thursday, May 30, 2013, Maksim Lin wrote:

I should also mention I am testing using curl -II and with
http://client.cors-api.appspot.com/client#?client_method=GET&client_credentials=false&server_url=http%3A%2F%2Fregistry.npmjs.org%2Fbops%2Flatest&server_enable=true&server_status=200&server_credentials=false&server_tabs=remote

—
Reply to this email directly or view it on GitHubhttps://github.com//issues/108#issuecomment-18717481
.

[maks]

@isaacs really appreciate you looking at this so quickly! Anytime you get a chance to look into it is fine.

[kumavis]

+1

[maks]

@isaacs would you have time to look into this again? with @dominictarr npmd now available it would be useful to try using it even in-browser.

[isaacs]

@jhs Maybe you could look at this? Did I do something wrong?

I've enabled cors for methods = GET, HEAD (since allowing PUTs and DELETEs would be stupidly dangerous) and for all hosts. However, it's not sending the proper headers, as far as I can tell.

[isaacs]

Oh, hahaha, nevermind. The issue was that I'd set origin: * instead of origins: *. Note the plural on "origins".

Can you try it now?

[nathanboktae]

CORS headers aren't there still. Try $.ajax('https://registry.npmjs.org/mocha') in the console here on github:

$.ajax('https://registry.npmjs.org/mocha')
Object {readyState: 1, getResponseHeader: function, getAllResponseHeaders: function, setRequestHeader: function, overrideMimeType: function…}
XMLHttpRequest cannot load https://registry.npmjs.org/mocha. No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'https://github.com' is therefore not allowed access.

[maks]

I wonder if the change the @isaacs made got backed out some how because I do remember trying it after it got closed and it was working then for me but yes now the headers are gone again.